The vulnerability is an out-of-bounds read in the Vlp32Decoder::unpack() function used by TIER IV Nebula. An unauthenticated attacker can send a short UDP datagram to the Velodyne sensor port that the driver exposes without a sender-address check. The decoder accesses memory past the end of the received buffer, causing fabricated point data to be silently published into downstream PointCloud2 messages consumed by Autoware components. This results in data-integrity violations that could lead to incorrect perception or decision-making by the autonomous system.

The affected product is TIER IV Nebula version 1.2.0 (any earlier releases share the same code path). The vendor list indicates tier4:nebula; no other affected versions are specified in the advisory.

The CVSS score of 8.7 shows high severity, and the attack vector is inferred to be remote, unauthenticated, and relies on UDP first designed for Velodyne sensor traffic. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a malformed UDP packet that triggers the out-of-bounds read, resulting in a remote data-integrity breach. There is no evidence of remote code execution or other direct privileges gained, but the impact on the autonomous vehicle’s perception stack can be significant.